fix(npm): IT API TLS helper + treat certificate_id string 0 as missing

- jq select includes certificate_id == "0" for NPM JSON quirks
- request-it-api-tls-npm.sh wraps CERT_DOMAINS_FILTER for it-api.sankofa.nexus
- Docs: TLS command, Cloudflare redirect-loop note; spec remaining items

Made-with: Cursor

scripts/deployment/request-it-api-tls-npm.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# Request Let's Encrypt via NPMplus for it-api.sankofa.nexus and assign to proxy host.
+# Requires NPM_* in repo .env. Same as:
+#   CERT_DOMAINS_FILTER='it-api\.sankofa\.nexus' bash scripts/request-npmplus-certificates.sh
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+export CERT_DOMAINS_FILTER='it-api\.sankofa\.nexus'
+exec bash "${PROJECT_ROOT}/scripts/request-npmplus-certificates.sh" "$@"